Text Message Scams (Smishing)
Scam texts (“smishing”) are now one of the most common ways criminals reach people. A text feels personal and urgent, and links on a phone screen are hard to check. One tap can lead to a fake website that steals your card number or login.
- Everyone
- Workers
Photo: phone showing a fake “unpaid toll” text with a strange link
Common scam texts
- Package delivery: “Your package couldn’t be delivered. Update your address here.”
- Unpaid tolls or tickets: “You owe $6.99 in tolls. Pay now to avoid penalties.”
- Bank or card alerts: “Suspicious charge. Reply YES or NO,” followed by a call from a fake fraud department.
- Account problems: streaming, phone carrier or app accounts “suspended.”
- Wrong number: a friendly “Is this Mike?” that turns into a friendship, romance or investment pitch. See Romance Scams.
- Job offers: high-paying remote work with no interview. See Job Scams.
- Boss or coworker: “It’s your supervisor, I need you to buy gift cards for a client.”
Red flags
- A link to a website that doesn’t match the company’s real address
- Urgency or threats
- A small payment request (to get your card number)
- Strange spelling or grammar, or a sender from an email address or unfamiliar number
- A request to reply, call a number, or move to another chat app
What to do
- Don’t tap links or reply, even to say STOP, to texts you don’t trust.
- Check directly: open the shipper’s app, your toll account or your bank’s app yourself, or call the number on your card.
- Forward scam texts to 7726 (SPAM) to report them to your carrier, then delete them.
- Report to the FTC at ReportFraud.ftc.gov.
- Turn on your phone’s spam filtering.
If you tapped or paid
- If you entered a card number, call your bank or card issuer immediately to block it.
- If you entered a password, change it everywhere you used it, and turn on two-factor authentication.
- If you shared personal information like your SSN, follow the steps at IdentityTheft.gov.
- Watch your accounts closely for the next few weeks.
See If an Account Is Hacked and Identity Theft.
Standards & references
Last updated: